# Zero-Tap Authentication Templates

Zero-tap authentication templates allow your users to receive one-time passwords or codes via WhatsApp without having to leave your application.

When a user in your app requests a password or code and you deliver it using a zero-tap authentication template, the WhatsApp client simply broadcasts the included password or code and your app can capture it immediately with a broadcast receiver.

From the user's perspective, they request a password or code in your app and the code appears in your app automatically. If your app user happens to check the message in the WhatsApp client, they will only see a message displaying the default fixed text: *< code > is your verification code.*

Like one-tap autofill button authentication templates, when the WhatsApp client receives the template message containing the user's password or code, Meta perform a series of eligibility checks. If the message fails this check and Meta is unable to broadcast the password or code, the message will display either a one-tap autofill button or a copy code button. For this reason, when you create a zero-tap authentication template, you must include a [one-tap autofill and copy code button](/docs/resources/authentication-messages.md#buttons) in your post body payload, even if the user may never see one of these buttons.

{% hint style="warning" %}
Zero-tap is only supported on Android. If you send a zero-tap authentication template to a WhatsApp user who is using a non-Android device, the WhatsApp client will display a copy code button instead. URLs, media, and emojis are not supported.
{% endhint %}

{% hint style="info" %}
When using Zero-Tap authentication templates, you must also perform a handshake and use the App Signing Key Hash to integrate with your software. For this, please refer [to Meta's documentation.](https://developers.facebook.com/docs/whatsapp/business-management-api/authentication-templates/zero-tap-authentication-templates#app-signing-key-hash)
{% endhint %}

## Best Practices <a href="#best-practices" id="best-practices"></a>

* Do not make WhatsApp your default password/code delivery method.
* Make it clear to your app users that the password or code will be automatically delivered to your app when they select WhatsApp for delivery.
* Link to Meta article [About security codes that automatically fill on WhatsApp](https://faq.whatsapp.com/659113242716268/?fbclid=IwAR2hVQxhk4u71ePXhKMsznNGiFa2WTkuL5felrlfd5xMnto4pJ_JKTVGTWI) in the help center, to support users who are worried about auto-delivery of the password or code.
* After the password/code is used in your app, make it clear to your app user that it was received successfully.

Here are some examples that make it clear to an app user that their code will automatically appear in the app:

<figure><img src="/files/hskS3aytR62iXE5TETDQ" alt=""><figcaption></figcaption></figure>

## Template Creation

You can use the WABA API to create zero-tap authentication templates. Alternatively, you can also create it using WhatsApp Manager.

Use the create template endpoint and assemble the authentication components in the request:

The base-url should be `https://waba-v2.360dialog.io`&#x20;

<mark style="color:green;">`POST`</mark> `[base-url]/v1/configs/templates`&#x20;

The message template name field is limited to 512 characters. The message template content field is limited to 1024 characters.

#### Headers

| Name         | Type   | Description |
| ------------ | ------ | ----------- |
| D360-API-KEY | string |             |

#### Request Body

| Name                                         | Type            | Description                                                                                                                                |
| -------------------------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| name<mark style="color:red;">\*</mark>       | string          |                                                                                                                                            |
| components<mark style="color:red;">\*</mark> | array\[objects] | Array of objects that describe the components that make up the template.                                                                   |
| category<mark style="color:red;">\*</mark>   | string          | Allowed values: **`AUTHENTICATION`**                                                                                                       |
| language<mark style="color:red;">\*</mark>   | string          | [View list of supported languages here.](https://developers.facebook.com/docs/whatsapp/api/messages/message-templates#supported-languages) |

{% tabs %}
{% tab title="200: OK " %}
Upon success, the API will respond with a JSON object describing the newly created template.

```javascript
{
    "id": "594425479261596",
    "status": "PENDING",
    "category": "AUTHENTICATION"
}
```

{% endtab %}
{% endtabs %}

#### Post Body <a href="#post-body" id="post-body"></a>

```json
{
  "name": "<TEMPLATE_NAME>",
  "language": "<TEMPLATE_LANGUAGE>",
  "category": "authentication",
  "message_send_ttl_seconds": <TIME_TO_LIVE>, // Optional
  "components": [
    {
      "type": "body",
      "add_security_recommendation": <SECURITY_RECOMMENDATION> // Optional
    },
    {
      "type": "footer",
      "code_expiration_minutes": <CODE_EXPIRATION> // Optional
    },
    {
      "type": "buttons",
      "buttons": [
        {
          "type": "otp",
          "otp_type": "zero_tap",
          "text": "<CODY_CODE_BUTTON_TEXT>", // Optional
          "autofill_text": "<AUTOFILL_BUTTON_TEXT>", // Optional
          "package_name": "<PACKAGE_NAME>",
          "signature_hash": "<SIGNATURE_HASH>",
          "zero_tap_terms_accepted": <TERMS_ACCEPTED>
        }
      ]
    }
  ]
}
```

Note that in your template creation request the button type is designated as `otp`, but upon creation the button type will be set to `url`. You can confirm this by performing a GET request on a newly created authentication template and analyzing its components.

#### Properties <a href="#properties" id="properties"></a>

| Placeholder                                                            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Example Value            |
| ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| <p><code>\<AUTOFILL\_BUTTON\_TEXT></code></p><p><em>String</em></p>    | <p><strong>Optional.</strong></p><p><br></p><p>One-tap autofill button label text.</p><p><br></p><p>If omitted, the autofill text will default to a pre-set value, localized to the template's language. For example, Autofill for English (US).</p><p><br></p><p>Maximum 25 characters.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `Autofill`               |
| <p><code>\<COPY\_CODE\_BUTTON\_TEXT></code></p><p><em>String</em></p>  | <p><strong>Optional.</strong></p><p><br></p><p>Copy code button label text.</p><p><br></p><p>If the message fails the <a href="https://developers.facebook.com/docs/whatsapp/business-management-api/authentication-templates/zero-tap-authentication-templates#eligibility-check">eligibility check</a> and displays a copy code button, the button will use this text label.</p><p><br></p><p>If omitted, and the message fails the eligibility check and displays a copy code button, the text will default to a pre-set value localized to the template's language. For example, <code>Copy Code</code> for English (US).</p><p><br></p><p>Maximum 25 characters.</p>                                                                                                                                                                                                                                                  | `Copy Code`              |
| <p><code>\<CODE\_EXPIRATION></code></p><p><em>Integer</em></p>         | <p><strong>Optional.</strong></p><p><br></p><p>Indicates the number of minutes the password or code is valid.</p><p><br></p><p>If included, the code expiration warning and this value will be displayed in the delivered message. If the message fails the <a href="https://developers.facebook.com/docs/whatsapp/business-management-api/authentication-templates/zero-tap-authentication-templates#eligibility-check">eligibility check</a> and displays a one-tap autofill button, the button will be disabled in the delivered message the indicated number of minutes from when the message was sent.</p><p><br></p><p>If omitted, the code expiration warning will not be displayed in the delivered message. If the message fails the eligibility check and displays a one-tap autofill button, the button will be disabled 10 minutes from when the message was sent.</p><p><br></p><p>Minimum 1, maximum 90.</p> | `5`                      |
| <p><code>\<PACKAGE\_NAME></code></p><p><em>String</em></p>             | <p><strong>Required.</strong></p><p><br></p><p>Your Android app's package name.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `com.example.luckyshrub` |
| <p><code>\<SECURITY\_RECOMMENDATION></code></p><p><em>Boolean</em></p> | <p><strong>Optional.</strong></p><p><br></p><p>Set to <code>true</code> if you want the template to include the fixed string, For your security, do not share this code. Set to <code>false</code> to exclude the string.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `true`                   |
| <p><code>\<SIGNATURE\_HASH></code></p><p><em>String</em></p>           | <p><strong>Required.</strong></p><p><br></p><p>Your app signing key hash. See <a href="https://developers.facebook.com/docs/whatsapp/business-management-api/authentication-templates/zero-tap-authentication-templates#app-signing-key-hash">App Signing Key Hash</a> below.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `K8a%2FAINcGX7`          |
| <p><code>\<TEMPLATE\_LANGUAGE></code></p><p><em>String</em></p>        | <p><strong>Required.</strong></p><p><br></p><p>Template <a href="https://developers.facebook.com/docs/whatsapp/business-management-api/message-templates/supported-languages">language and locale code</a>.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `en_US`                  |
| <p><code>\<TEMPLATE\_NAME></code></p><p><em>String</em></p>            | <p><strong>Required.</strong></p><p><br></p><p>Template name.</p><p><br></p><p>Maximum 512 characters.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `zero_tap_auth_template` |
| <p><code>\<TERMS\_ACCEPTED></code></p><p><em>Boolean</em></p>          | <p><strong>Required.</strong></p><p><br></p><p>Set to <code>true</code> to indicate that you understand that your use of zero-tap authentication is subject to the WhatsApp Business Terms of Service, and that it's your responsibility to ensure your customers expect that the code will be automatically filled in on their behalf when they choose to receive the zero-tap code through WhatsApp.</p><p><br></p><p>If set to <code>false</code>, the template will <strong>not</strong> be created as you need to accept zero-tap terms before creating zero-tap enabled message templates.</p>                                                                                                                                                                                                                                                                                                                       | `true`                   |
| <p><code>\<TIME\_TO\_LIVE></code></p><p><em>Integer</em></p>           | <p><strong>Optional.</strong></p><p><br></p><p>Authentication message time-to-live value, in seconds. See <a href="/pages/G1Pl0DYYkDyeWDAd7lVG#time-to-live">Time-To-Live</a>.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | `60`                     |

#### Example Request <a href="#example-request" id="example-request"></a>

```json
{
  "name": "zero_tap_auth_template",
  "language": "en_US",
  "category": "authentication",
  "message_send_ttl_seconds": 60,
  "components": [
    {
      "type": "body",
      "add_security_recommendation": true
    },
    {
      "type": "footer",
      "code_expiration_minutes": 5
    },
    {
      "type": "buttons",
      "buttons": [
        {
          "type": "otp",
          "otp_type": "zero_tap",
          "text": "Copy Code",
          "autofill_text": "Autofill",
          "package_name": "com.example.luckyshrub",
          "signature_hash": "K8a%2FAINcGX7",
          "zero_tap_terms_accepted": true
        }
      ]
    }
  ]
}
```

## Sending Zero-Tap Authentication Template Messages <a href="#sending-zero-tap-authentication-template-messages" id="sending-zero-tap-authentication-template-messages"></a>

See our[ Authentication Templates documentation](/docs/resources/authentication-messages.md) to learn how to send it to customers.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.360dialog.com/docs/resources/authentication-messages/zero-tap-authentication-templates.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.